windows-development-sandbox 1.4.0 → 1.4.3

package/dist/shared/download/downloader.js

@@ -0,0 +1,110 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { Readable, Transform } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { safeRemove } from '../io/index.js';
+import { fetchRetry } from './http.js';
+import { extractArchive, findFile, moveIntoPlace, stagingFolder } from './archive.js';
+export class Downloader {
+    /** downloads.requireChecksum: refuse anything without an expected hash. The guest sets it from session.json. */
+    requireChecksum = false;
+    watcher = null;
+    /** Reports coarse progress of the downloads that start from now on to `watcher` (null: stop). */
+    watch(watcher) {
+        this.watcher = watcher;
+    }
+    /**
+     * Streams a download to disk, hashing as it goes: big archives (PostgreSQL is ~330 MB) never sit in memory, and the
+     * event loop stays free so other toolchains keep downloading meanwhile. A mismatch (or any failure) leaves no file
+     * behind.
+     */
+    async file(url, destination, expected = null) {
+        const sums = typeof expected === 'string' || expected === null ? { sha256: expected } : expected;
+        if (this.requireChecksum && !sums.sha256?.trim() && !sums.sha512?.trim()) {
+            throw new Error('Refusing to download ' +
+                path.basename(destination) +
+                ' (' +
+                url +
+                '): no checksum is published for it, and downloads.requireChecksum is on. Turn that setting off to allow downloads that cannot be verified.');
+        }
+        const response = await fetchRetry(url, {}, 3, 20 * 60 * 1000);
+        if (!response.body)
+            throw new Error('Empty response for ' + url);
+        fs.mkdirSync(path.dirname(destination), { recursive: true });
+        // Only the hashes that will be checked (sha512 of a 330 MB archive is not free).
+        const checks = ['sha256', 'sha512'].flatMap((kind) => {
+            const want = sums[kind]?.trim().toLowerCase();
+            return want ? [{ want, hash: crypto.createHash(kind) }] : [];
+        });
+        // Progress for the boot screen: every 10% or 5 s at most, never per chunk; called here so it knows who is downloading.
+        const size = Number(response.headers.get('content-length')) || 0;
+        const report = size > 0 ? (this.watcher?.() ?? null) : null;
+        let received = 0;
+        let tenth = 0;
+        let reportedAt = Date.now();
+        const tap = new Transform({
+            transform(chunk, _encoding, done) {
+                for (const c of checks)
+                    c.hash.update(chunk);
+                if (report) {
+                    received += chunk.length;
+                    const now = Math.floor((received * 10) / size);
+                    if (now !== tenth || Date.now() - reportedAt > 5000) {
+                        tenth = now;
+                        reportedAt = Date.now();
+                        try {
+                            report(Math.min(1, received / size));
+                        }
+                        catch {
+                            /* progress never breaks a download */
+                        }
+                    }
+                }
+                done(null, chunk);
+            },
+        });
+        // Written to <destination>.part and moved into place only once complete and verified, so an interrupted download
+        // never leaves a partial file under the real name.
+        const partial = destination + '.part';
+        try {
+            await pipeline(Readable.fromWeb(response.body), tap, fs.createWriteStream(partial));
+            if (checks.some((c) => c.hash.digest('hex') !== c.want))
+                throw new Error('Checksum mismatch for ' + url);
+            // Mapped folders refuse rename-over, so the old file goes first.
+            fs.rmSync(destination, { force: true });
+            fs.renameSync(partial, destination);
+        }
+        finally {
+            fs.rmSync(partial, { force: true });
+        }
+    }
+    /**
+     * Downloads + extracts into `destination` atomically (staging folder, then rename). With `locate`, only the folder
+     * holding that file is kept (`up` folders above it, e.g. locate ruby.exe with up 1 keeps the folder around bin).
+     */
+    async archive(url, destination, options = {}) {
+        const work = stagingFolder(destination);
+        try {
+            const archive = path.join(work, options.fileName ?? path.basename(new URL(url).pathname));
+            await this.file(url, archive, { sha256: options.sha256, sha512: options.sha512 });
+            const extracted = path.join(work, 'x');
+            await extractArchive(archive, extracted, options.members);
+            let root = extracted;
+            if (options.locate) {
+                const found = findFile(extracted, options.locate);
+                if (!found)
+                    throw new Error(options.locate + ' not found in ' + url);
+                root = path.dirname(found);
+                for (let i = 0; i < (options.up ?? 0) && path.dirname(root).startsWith(extracted); i++)
+                    root = path.dirname(root);
+            }
+            moveIntoPlace(root, destination);
+        }
+        finally {
+            safeRemove(work, path.dirname(work));
+        }
+    }
+}
+/** The one downloader of this process. */
+export const downloader = new Downloader();

package/dist/shared/download/github.d.ts

@@ -0,0 +1,16 @@
+export interface ReleaseAsset {
+    url: string;
+    name: string;
+    sha256: string | null;
+}
+/**
+ * Finds an asset in the latest GitHub release of `repo` (with its published sha256 when available). With
+ * `searchOlder`, falls back to the newest stable release that still ships a matching asset (projects drop assets).
+ */
+export declare const githubAsset: (repo: string, pattern: RegExp, searchOlder?: boolean) => Promise<ReleaseAsset>;
+/** A release's assets from github.com's expanded_assets page (no API rate limit): each download link, then its sha256. */
+export declare const parseReleasePage: (html: string) => ReleaseAsset[];
+/** The latest release's tag, from github.com's own redirect (no API, no rate limit). */
+export declare const latestGithubTag: (repo: string) => Promise<string>;
+/** Release tags in the order github.com's /<repo>/releases page lists them (newest first), without duplicates. */
+export declare const parseReleaseTags: (html: string, repo: string) => string[];

package/dist/shared/download/github.js

@@ -0,0 +1,74 @@
+import { fetchJson, fetchRetry, fetchText } from './http.js';
+const toAsset = (asset) => ({
+    url: asset.browser_download_url,
+    name: asset.name,
+    sha256: asset.digest?.startsWith('sha256:') ? asset.digest.slice(7) : null,
+});
+/**
+ * Finds an asset in the latest GitHub release of `repo` (with its published sha256 when available). With
+ * `searchOlder`, falls back to the newest stable release that still ships a matching asset (projects drop assets).
+ */
+export const githubAsset = async (repo, pattern, searchOlder = false) => {
+    let latest;
+    try {
+        latest = await fetchJson('https://api.github.com/repos/' + repo + '/releases/latest');
+    }
+    catch (e) {
+        // The API allows 60 requests an hour per IP without a token; a first boot alone makes a dozen. The release page has
+        // the same assets and digests and no such limit.
+        if (!/HTTP (403|429)/.test(e instanceof Error ? e.message : ''))
+            throw e;
+        return githubAssetFromPage(repo, pattern, searchOlder);
+    }
+    const hit = latest.assets.find((a) => pattern.test(a.name));
+    if (hit)
+        return toAsset(hit);
+    if (searchOlder) {
+        const releases = await fetchJson('https://api.github.com/repos/' + repo + '/releases?per_page=100');
+        for (const release of releases.filter((r) => !r.prerelease && !r.draft)) {
+            const older = release.assets.find((a) => pattern.test(a.name));
+            if (older)
+                return toAsset(older);
+        }
+    }
+    throw new Error('No asset matching ' + pattern + ' in the ' + (searchOlder ? 'stable' : 'latest') + ' ' + repo + ' release(s)');
+};
+/** A release's assets from github.com's expanded_assets page (no API rate limit): each download link, then its sha256. */
+export const parseReleasePage = (html) => {
+    const links = [...html.matchAll(/href="(\/[^"]+\/releases\/download\/[^"]+)"/g)];
+    return links.map((link, i) => {
+        const digest = /sha256:([0-9a-f]{64})/.exec(html.slice(link.index, links[i + 1]?.index ?? html.length))?.[1] ?? null;
+        return { url: 'https://github.com' + link[1], name: decodeURIComponent(link[1].split('/').pop()), sha256: digest };
+    });
+};
+/** The latest release's tag, from github.com's own redirect (no API, no rate limit). */
+export const latestGithubTag = async (repo) => {
+    const latest = await fetchRetry('https://github.com/' + repo + '/releases/latest', {}, 2, 20000);
+    const tag = decodeURIComponent(latest.url.split('/releases/tag/')[1] ?? '');
+    return tag || Promise.reject(new Error('Could not find the latest release of ' + repo));
+};
+/** Release tags in the order github.com's /<repo>/releases page lists them (newest first), without duplicates. */
+export const parseReleaseTags = (html, repo) => {
+    const escaped = repo.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&');
+    const tags = [...html.matchAll(new RegExp('href="/' + escaped + '/releases/tag/([^"?#]+)"', 'gi'))].map((m) => decodeURIComponent(m[1]));
+    return [...new Set(tags)];
+};
+/** How many releases the rate-limit fallback looks through for `searchOlder` (one page request each). */
+const OLDER_RELEASES = 10;
+const githubAssetFromPage = async (repo, pattern, searchOlder) => {
+    const assetsOf = async (tag) => parseReleasePage(await fetchText('https://github.com/' + repo + '/releases/expanded_assets/' + encodeURIComponent(tag))).find((a) => pattern.test(a.name));
+    const latest = await latestGithubTag(repo);
+    const hit = await assetsOf(latest);
+    if (hit)
+        return hit;
+    // nvm-windows' portable zip and winlibs' builds only exist in older releases: walk the release list like the API path does.
+    if (searchOlder) {
+        const older = parseReleaseTags(await fetchText('https://github.com/' + repo + '/releases'), repo).filter((t) => t !== latest);
+        for (const tag of older.slice(0, OLDER_RELEASES)) {
+            const found = await assetsOf(tag);
+            if (found)
+                return found;
+        }
+    }
+    throw new Error('No asset matching ' + pattern + ' in ' + repo + ' ' + latest + (searchOlder ? ' or the releases before it' : ''));
+};

package/dist/shared/download/http.d.ts

@@ -0,0 +1,5 @@
+/** fetch with retries (the sandbox network can take a few seconds to come up) and a timeout per attempt. */
+export declare const fetchRetry: (url: string, init?: RequestInit, attempts?: number, timeoutMs?: number) => Promise<Response>;
+/** Small lookups fail fast (2 tries, 20 s each) so an offline boot falls back to cached versions quickly. */
+export declare const fetchJson: <T>(url: string) => Promise<T>;
+export declare const fetchText: (url: string) => Promise<string>;

package/dist/shared/download/http.js

@@ -0,0 +1,30 @@
+// Download/extract helpers shared by the host (Windows Terminal pre-download) and the guest (toolchains).
+// Node built-ins only, so it stays small in both bundles (the CLI and the guest runtime).
+const USER_AGENT = 'windows-development-sandbox';
+/** fetch with retries (the sandbox network can take a few seconds to come up) and a timeout per attempt. */
+export const fetchRetry = async (url, init = {}, attempts = 5, timeoutMs = 60000) => {
+    let last;
+    for (let i = 1; i <= attempts; i++) {
+        try {
+            const response = await fetch(url, {
+                ...init,
+                signal: AbortSignal.timeout(timeoutMs),
+                headers: { 'User-Agent': USER_AGENT, ...(init.headers ?? {}) },
+            });
+            if (response.ok)
+                return response;
+            last = new Error('HTTP ' + response.status + ' for ' + url);
+            if (response.status === 404)
+                break;
+        }
+        catch (e) {
+            last = e;
+        }
+        if (i < attempts)
+            await new Promise((r) => setTimeout(r, 3000));
+    }
+    throw last instanceof Error ? last : new Error(String(last));
+};
+/** Small lookups fail fast (2 tries, 20 s each) so an offline boot falls back to cached versions quickly. */
+export const fetchJson = async (url) => (await (await fetchRetry(url, { headers: { Accept: 'application/json' } }, 2, 20000)).json());
+export const fetchText = async (url) => await (await fetchRetry(url)).text();

package/dist/shared/download/index.d.ts

@@ -0,0 +1,5 @@
+export { fetchRetry, fetchJson, fetchText } from './http.js';
+export { stagingFolder, moveIntoPlace, extractArchive, findFile } from './archive.js';
+export { type ArchiveOptions, type Checksums, type DownloadWatcher, Downloader, downloader } from './downloader.js';
+export { spawnAsync } from './spawn.js';
+export { type ReleaseAsset, githubAsset, parseReleasePage, latestGithubTag, parseReleaseTags } from './github.js';

package/dist/shared/download/index.js

@@ -0,0 +1,5 @@
+export { fetchRetry, fetchJson, fetchText } from './http.js';
+export { stagingFolder, moveIntoPlace, extractArchive, findFile } from './archive.js';
+export { Downloader, downloader } from './downloader.js';
+export { spawnAsync } from './spawn.js';
+export { githubAsset, parseReleasePage, latestGithubTag, parseReleaseTags } from './github.js';

package/dist/shared/download/spawn.d.ts

@@ -0,0 +1,2 @@
+/** Runs a program without blocking the event loop (parallel downloads keep going); resolves with its exit code. */
+export declare const spawnAsync: (file: string, args: string[], options?: import("node:child_process").SpawnOptions) => Promise<number>;

package/dist/shared/download/spawn.js

@@ -0,0 +1,7 @@
+import { spawn } from 'node:child_process';
+/** Runs a program without blocking the event loop (parallel downloads keep going); resolves with its exit code. */
+export const spawnAsync = (file, args, options = {}) => new Promise((resolve, reject) => {
+    const child = spawn(file, args, { stdio: 'ignore', windowsHide: true, ...options });
+    child.once('error', reject);
+    child.once('close', (code) => resolve(code ?? -1));
+});

package/dist/shared/io/index.d.ts

@@ -0,0 +1,3 @@
+export * from './json.js';
+export * from './json-file.js';
+export * from './safe-remove.js';

package/dist/shared/io/index.js

@@ -0,0 +1,3 @@
+export * from './json.js';
+export * from './json-file.js';
+export * from './safe-remove.js';

package/dist/shared/io/json-file.d.ts

@@ -0,0 +1,10 @@
+import type { z } from 'zod';
+export declare class JsonFile<T> {
+    private readonly schema;
+    readonly file: string;
+    constructor(schema: z.ZodType<T>, file: string);
+    read(): T | null;
+    write(value: T): void;
+    /** Reads, changes and writes back; returns what was written. */
+    update(change: (current: T | null) => T): T;
+}

package/dist/shared/io/json-file.js

@@ -0,0 +1,21 @@
+import { readValid, writeJsonAtomic } from './json.js';
+export class JsonFile {
+    schema;
+    file;
+    constructor(schema, file) {
+        this.schema = schema;
+        this.file = file;
+    }
+    read() {
+        return readValid(this.schema, this.file);
+    }
+    write(value) {
+        writeJsonAtomic(this.file, value);
+    }
+    /** Reads, changes and writes back; returns what was written. */
+    update(change) {
+        const next = change(this.read());
+        this.write(next);
+        return next;
+    }
+}

package/dist/shared/io/json.d.ts

@@ -0,0 +1,13 @@
+import type { z } from 'zod';
+/** Anything bigger than this from the other side is ignored (a compromised sandbox must not exhaust the host). */
+export declare const MAX_MESSAGE_BYTES: number;
+export declare const readJsonFile: <T>(file: string) => T | null;
+/** Reads and validates; a missing, oversized or malformed file is simply absent. */
+export declare const readValid: <S extends z.ZodType>(schema: S, file: string) => z.output<S> | null;
+/**
+ * Write to a uniquely named temp file and rename, so a reader on the other side of the mapped folder never sees half a
+ * file. The rename is retried briefly: antivirus or the other side's reader can hold the target for a moment.
+ */
+export declare const writeJsonAtomic: (file: string, value: unknown) => void;
+/** Same for any text file (two commands at once, or a watcher and a command, never leave a half-written file). */
+export declare const writeFileAtomic: (file: string, text: string) => void;

package/dist/shared/io/json.js

@@ -0,0 +1,49 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertTestWritable } from '../test-guard.js';
+/** Anything bigger than this from the other side is ignored (a compromised sandbox must not exhaust the host). */
+export const MAX_MESSAGE_BYTES = 8 * 1024 * 1024;
+export const readJsonFile = (file) => {
+    try {
+        if (fs.statSync(file).size > MAX_MESSAGE_BYTES)
+            return null;
+        return JSON.parse(fs.readFileSync(file, 'utf8').replace(/^\uFEFF/, ''));
+    }
+    catch {
+        return null;
+    }
+};
+/** Reads and validates; a missing, oversized or malformed file is simply absent. */
+export const readValid = (schema, file) => {
+    const parsed = schema.safeParse(readJsonFile(file));
+    return parsed.success ? parsed.data : null;
+};
+const pause = (ms) => {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+};
+/**
+ * Write to a uniquely named temp file and rename, so a reader on the other side of the mapped folder never sees half a
+ * file. The rename is retried briefly: antivirus or the other side's reader can hold the target for a moment.
+ */
+export const writeJsonAtomic = (file, value) => writeFileAtomic(file, JSON.stringify(value, null, 2) + '\n');
+/** Same for any text file (two commands at once, or a watcher and a command, never leave a half-written file). */
+export const writeFileAtomic = (file, text) => {
+    assertTestWritable(file);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const temp = file + '.' + process.pid + '-' + Math.random().toString(36).slice(2) + '.tmp';
+    fs.writeFileSync(temp, text, { encoding: 'utf8', flag: 'wx' });
+    for (let attempt = 1;; attempt++) {
+        try {
+            fs.renameSync(temp, file);
+            return;
+        }
+        catch (e) {
+            const code = e.code;
+            if (attempt >= 8 || (code !== 'EPERM' && code !== 'EBUSY' && code !== 'EACCES')) {
+                fs.rmSync(temp, { force: true });
+                throw e;
+            }
+            pause(50 * attempt);
+        }
+    }
+};

package/dist/shared/{safe-remove.js → io/safe-remove.js}

@@ -3,17 +3,42 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { assertTestWritable } from './test-guard.js';
-const norm = (p) => path.resolve(p).replace(/[\\/]+$/, '').toLowerCase();
-const isAncestorOrSame = (parent, child) => { const a = norm(parent); const b = norm(child); return a === b || b.startsWith(a + path.sep); };
+import { assertTestWritable } from '../test-guard.js';
+const norm = (p) => path
+    .resolve(p)
+    .replace(/[\\/]+$/, '')
+    .toLowerCase();
+const isAncestorOrSame = (parent, child) => {
+    const a = norm(parent);
+    const b = norm(child);
+    return a === b || b.startsWith(a + path.sep);
+};
 /** Folders no delete may ever reach, or contain: profiles, Windows, program folders. */
 const protectedFolders = () => [
-    os.homedir(), process.env.USERPROFILE, process.env.APPDATA, process.env.LOCALAPPDATA, path.join(os.homedir(), 'Documents'), path.join(os.homedir(), 'Desktop'),
-    process.env.SystemRoot, process.env.WINDIR, process.env.ProgramFiles, process.env['ProgramFiles(x86)'], process.env.ProgramData, 'C:\\Users', 'C:\\Windows',
+    os.homedir(),
+    process.env.USERPROFILE,
+    process.env.APPDATA,
+    process.env.LOCALAPPDATA,
+    path.join(os.homedir(), 'Documents'),
+    path.join(os.homedir(), 'Desktop'),
+    process.env.SystemRoot,
+    process.env.WINDIR,
+    process.env.ProgramFiles,
+    process.env['ProgramFiles(x86)'],
+    process.env.ProgramData,
+    'C:\\Users',
+    'C:\\Windows',
 ].filter((p) => typeof p === 'string' && p.trim() !== '');
 /** Folders nothing of ours lives in, so nothing below them may be deleted either. */
-const systemFolders = () => [process.env.SystemRoot, process.env.WINDIR, process.env.ProgramFiles, process.env['ProgramFiles(x86)'], 'C:\\Windows', 'C:\\Program Files', 'C:\\Program Files (x86)']
-    .filter((p) => typeof p === 'string' && p.trim() !== '');
+const systemFolders = () => [
+    process.env.SystemRoot,
+    process.env.WINDIR,
+    process.env.ProgramFiles,
+    process.env['ProgramFiles(x86)'],
+    'C:\\Windows',
+    'C:\\Program Files',
+    'C:\\Program Files (x86)',
+].filter((p) => typeof p === 'string' && p.trim() !== '');
 /**
  * Why `target` may not be deleted, or null when it may. Refused: a relative path, a drive root, a protected folder or
  * any folder that contains one, and anything that is not strictly inside `root`.

package/dist/shared/{netrules.js → network/firewall-rules.js}

@@ -1,7 +1,20 @@
 /** Private, carrier-grade NAT (Tailscale and similar live here), link-local and multicast ranges. */
-export const PRIVATE_V4 = ['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16', '100.64.0.0/10', '169.254.0.0/16', '224.0.0.0/4'];
+export const PRIVATE_V4 = [
+    '10.0.0.0/8',
+    '172.16.0.0/12',
+    '192.168.0.0/16',
+    '100.64.0.0/10',
+    '169.254.0.0/16',
+    '224.0.0.0/4',
+];
 export const PRIVATE_V6 = ['fc00::/7', 'fe80::/10', 'ff00::/8'];
-export const RULE_NAMES = ['AgentSandbox-Block-Private', 'AgentSandbox-Block-IPv6-Local', 'AgentSandbox-Block-SMB', 'AgentSandbox-Gateway-TCP', 'AgentSandbox-Gateway-UDP'];
+export const RULE_NAMES = [
+    'AgentSandbox-Block-Private',
+    'AgentSandbox-Block-IPv6-Local',
+    'AgentSandbox-Block-SMB',
+    'AgentSandbox-Gateway-TCP',
+    'AgentSandbox-Gateway-UDP',
+];
 export const isIPv4 = (ip) => {
     const parts = ip.split('.');
     return parts.length === 4 && parts.every((p) => /^\d{1,3}$/.test(p) && Number(p) <= 255);
@@ -45,7 +58,10 @@ export const formatRange = (range) => {
 };
 export const isPrivateV4 = (ip) => {
     const n = ipToInt(ip);
-    return PRIVATE_V4.some((c) => { const [s, e] = cidrToRange(c); return n >= s && n <= e; });
+    return PRIVATE_V4.some((c) => {
+        const [s, e] = cidrToRange(c);
+        return n >= s && n <= e;
+    });
 };
 export const parseDefaultGateways = (routePrint) => {
     const found = [];
@@ -82,7 +98,18 @@ export const parseDnsServers = (ipconfigAll) => {
 export const buildFirewallCommands = (exemptIps) => {
     const exempt = [...new Set(exemptIps.filter((ip) => isIPv4(ip) && isPrivateV4(ip)))];
     const v4 = subtractIps(PRIVATE_V4.map(cidrToRange), exempt).map(formatRange);
-    const add = (name, extra) => ['advfirewall', 'firewall', 'add', 'rule', 'name=' + name, 'dir=out', 'action=block', 'enable=yes', 'profile=any', ...extra];
+    const add = (name, extra) => [
+        'advfirewall',
+        'firewall',
+        'add',
+        'rule',
+        'name=' + name,
+        'dir=out',
+        'action=block',
+        'enable=yes',
+        'profile=any',
+        ...extra,
+    ];
     const commands = [];
     for (const name of RULE_NAMES)
         commands.push(['advfirewall', 'firewall', 'delete', 'rule', 'name=' + name]);
@@ -92,7 +119,11 @@ export const buildFirewallCommands = (exemptIps) => {
     commands.push(add('AgentSandbox-Block-SMB', ['protocol=tcp', 'remoteport=135,139,445']));
     if (exempt.length > 0) {
         commands.push(add('AgentSandbox-Gateway-TCP', ['protocol=tcp', 'remoteip=' + exempt.join(','), 'remoteport=1-52,54-65535']));
-        commands.push(add('AgentSandbox-Gateway-UDP', ['protocol=udp', 'remoteip=' + exempt.join(','), 'remoteport=1-52,54-66,69-65535']));
+        commands.push(add('AgentSandbox-Gateway-UDP', [
+            'protocol=udp',
+            'remoteip=' + exempt.join(','),
+            'remoteport=1-52,54-66,69-65535',
+        ]));
     }
     return commands;
 };

package/dist/shared/network/index.d.ts

@@ -0,0 +1,2 @@
+export * from './policy.js';
+export * from './firewall-rules.js';

package/dist/shared/network/index.js

@@ -0,0 +1,2 @@
+export * from './policy.js';
+export * from './firewall-rules.js';

package/dist/shared/{netpolicy.js → network/policy.js}

@@ -9,21 +9,74 @@ export const HOST_PATTERN = /^(\*\.)?([a-z0-9-]+\.)*[a-z0-9-]+$/i;
  */
 export const DEVELOPER_HOSTS = [
     // AI providers
-    'api.anthropic.com', 'claude.ai', '*.claude.ai', 'console.anthropic.com', 'statsig.anthropic.com', 'sentry.io', '*.sentry.io',
-    'api.openai.com', 'chatgpt.com', '*.openai.com', 'generativelanguage.googleapis.com', 'oauth2.googleapis.com', 'accounts.google.com',
+    'api.anthropic.com',
+    'claude.ai',
+    '*.claude.ai',
+    'console.anthropic.com',
+    'statsig.anthropic.com',
+    'sentry.io',
+    '*.sentry.io',
+    'api.openai.com',
+    'chatgpt.com',
+    '*.openai.com',
+    'generativelanguage.googleapis.com',
+    'oauth2.googleapis.com',
+    'accounts.google.com',
     // source hosts
-    'github.com', '*.github.com', '*.githubusercontent.com', 'codeload.github.com', 'gitlab.com', '*.gitlab.com', 'bitbucket.org',
+    'github.com',
+    '*.github.com',
+    '*.githubusercontent.com',
+    'codeload.github.com',
+    'gitlab.com',
+    '*.gitlab.com',
+    'bitbucket.org',
     // package registries
-    'registry.npmjs.org', '*.npmjs.org', 'registry.yarnpkg.com', 'pypi.org', 'files.pythonhosted.org', 'crates.io', 'index.crates.io', 'static.crates.io',
-    'proxy.golang.org', 'sum.golang.org', 'repo1.maven.org', 'repo.maven.apache.org', 'plugins.gradle.org', 'services.gradle.org', 'api.nuget.org',
-    '*.nuget.org', 'rubygems.org', 'index.rubygems.org', 'repo.packagist.org', 'packagist.org', 'jsr.io', 'deno.land',
+    'registry.npmjs.org',
+    '*.npmjs.org',
+    'registry.yarnpkg.com',
+    'pypi.org',
+    'files.pythonhosted.org',
+    'crates.io',
+    'index.crates.io',
+    'static.crates.io',
+    'proxy.golang.org',
+    'sum.golang.org',
+    'repo1.maven.org',
+    'repo.maven.apache.org',
+    'plugins.gradle.org',
+    'services.gradle.org',
+    'api.nuget.org',
+    '*.nuget.org',
+    'rubygems.org',
+    'index.rubygems.org',
+    'repo.packagist.org',
+    'packagist.org',
+    'jsr.io',
+    'deno.land',
     // toolchains
-    'nodejs.org', '*.nodejs.org', 'static.rust-lang.org', 'go.dev', 'dl.google.com', 'aka.ms', 'download.visualstudio.microsoft.com',
-    'dotnetcli.azureedge.net', 'builds.dotnet.microsoft.com', 'api.adoptium.net', 'objects.githubusercontent.com', 'marketplace.visualstudio.com',
-    '*.gallerycdn.vsassets.io', '*.vscode-cdn.net', 'update.code.visualstudio.com',
+    'nodejs.org',
+    '*.nodejs.org',
+    'static.rust-lang.org',
+    'go.dev',
+    'dl.google.com',
+    'aka.ms',
+    'download.visualstudio.microsoft.com',
+    'dotnetcli.azureedge.net',
+    'builds.dotnet.microsoft.com',
+    'api.adoptium.net',
+    'objects.githubusercontent.com',
+    'marketplace.visualstudio.com',
+    '*.gallerycdn.vsassets.io',
+    '*.vscode-cdn.net',
+    'update.code.visualstudio.com',
 ];
 /** The allowOnly list with "@developer" expanded, lower case, without duplicates. */
-export const expandAllowList = (list) => [...new Set(list.flatMap((h) => (h.trim().toLowerCase() === '@developer' ? DEVELOPER_HOSTS : [h])).map((h) => h.trim().toLowerCase()).filter((h) => HOST_PATTERN.test(h)))];
+export const expandAllowList = (list) => [
+    ...new Set(list
+        .flatMap((h) => (h.trim().toLowerCase() === '@developer' ? DEVELOPER_HOSTS : [h]))
+        .map((h) => h.trim().toLowerCase())
+        .filter((h) => HOST_PATTERN.test(h))),
+];
 /** Does `host` match one of the patterns? "*.example.com" matches its subdomains (not example.com itself). */
 export const hostAllowed = (host, patterns) => {
     const h = host.toLowerCase().replace(/\.$/, '');
@@ -36,7 +89,9 @@ export const withBlockedHosts = (hostsFile, hosts) => {
     const begin = hostsFile.indexOf(HOSTS_BEGIN);
     const end = hostsFile.indexOf(HOSTS_END);
     const outside = begin >= 0 && end > begin ? hostsFile.slice(0, begin) + hostsFile.slice(end + HOSTS_END.length) : hostsFile;
-    const clean = [...new Set(hosts.map((h) => h.trim().toLowerCase()).filter((h) => HOST_PATTERN.test(h) && !h.startsWith('*.')))];
+    const clean = [
+        ...new Set(hosts.map((h) => h.trim().toLowerCase()).filter((h) => HOST_PATTERN.test(h) && !h.startsWith('*.'))),
+    ];
     const base = outside.replace(/\s+$/, '');
     if (!clean.length)
         return base + '\r\n';

package/dist/shared/{paths.js → paths/claude-paths.js}

@@ -15,7 +15,13 @@ const DEVICE_NAME = /^(con|prn|aux|nul|conin\$|conout\$|com[0-9¹²³]|lpt[0-9¹
  * A file or folder name that is safe to recreate on this PC. The sandbox can create names Windows would treat as devices
  * (CON.jsonl opens the console), as streams (a:b), or that end in a dot or space (silently renamed); none of them are copied.
  */
-export const isSafeFileName = (name) => name !== '' && name.length <= 200 && name !== '.' && name !== '..' && !/[<>:"|?*/\\\x00-\x1f]/.test(name) && !/[. ]$/.test(name) && !DEVICE_NAME.test(name);
+export const isSafeFileName = (name) => name !== '' &&
+    name.length <= 200 &&
+    name !== '.' &&
+    name !== '..' &&
+    !/[<>:"|?*/\\\x00-\x1f]/.test(name) &&
+    !/[. ]$/.test(name) &&
+    !DEVICE_NAME.test(name);
 const jsonEscaped = (p) => JSON.stringify(p).slice(1, -1);
 const escapeRegex = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 const forward = (p) => p.replace(/\\/g, '/');
@@ -23,6 +29,10 @@ const forward = (p) => p.replace(/\\/g, '/');
 export const translatePaths = (text, from, to) => {
     if (from.toLowerCase() === to.toLowerCase())
         return text;
-    const pairs = [[jsonEscaped(from), jsonEscaped(to)], [from, to], [forward(from), forward(to)]];
+    const pairs = [
+        [jsonEscaped(from), jsonEscaped(to)],
+        [from, to],
+        [forward(from), forward(to)],
+    ];
     return pairs.reduce((out, [a, b]) => out.replace(new RegExp(escapeRegex(a) + '(?=\\\\|/|"|\'|\\s|$)', 'gi'), b.replace(/\$/g, '$$$$')), text);
 };